o
    j                     @   sV   d dl Z d dlZd dlmZ d dlmZ d dlmZ G dd dZG dd deZ	dS )	    N)logger)PackageDecryptor)PRTL_AVL_TABLEc                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
TspkgCredentialc                 C   s(   d| _ d | _d | _d | _d| _d | _d S )Ntspkg    credtypeusername
domainnamepasswordpassword_rawluidself r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/lsadecryptor/packages/tspkg/decryptor.py__init__   s   
zTspkgCredential.__init__c                 C   sD   i }| j |d< | j|d< | j|d< | j|d< | j|d< | j|d< |S )Nr	   r
   r   r   r   r   r   r   tr   r   r   to_dict   s   





zTspkgCredential.to_dictc                 C   s   t |  S )N)jsondumpsr   r   r   r   r   to_json    s   zTspkgCredential.to_jsonc                 C   sJ   d| j  }|d| j 7 }|d| j 7 }|d| j 7 }|d| j  7 }|S )Nz	== TSPKG [%x]==
z		username %s
z		domainname %s
z		password %s
z		password (hex)%s
)r   r
   r   r   r   hexr   r   r   r   __str__#   s   
zTspkgCredential.__str__N)__name__
__module____qualname__r   r   r   r   r   r   r   r   r      s
    
r   c                       s,   e Zd Z fddZdd Zdd Z  ZS )TspkgDecryptorc                    s"   t  d||| || _g | _d S )NTspkg)superr   decryptor_templatecredentials)r   readerr"   lsa_decryptorsysinfo	__class__r   r   r   ,   s   
zTspkgDecryptor.__init__c                 C   s8   |  d| jj}| j|| jj }| j|}||fS )Nz	TSpkg.dll)find_signaturer"   	signaturer$   get_ptr_with_offset
avl_offsetget_ptr)r   positionptr_entry_loc	ptr_entryr   r   r   find_first_entry2   s   zTspkgDecryptor.find_first_entryc              
   C   s  z|   \}}W n ty" } z| d|  W Y d }~d S d }~ww g }| j| zt| j| j}W n tyP } ztd|  W Y d }~d S d }~ww | 	|j
j| |D ]y}| || jjj | j| | j| j}|j| j}|d urt }	|j|	_|jj| j|	_|jj| j|	_|jjjdkr|jj| j}
|	jddu r| j|
dd\|	_|	_ |	jd ur|	j! |	_n	| |
\|	_|	_ | j"|	 q[d S )Nz"Failed to find structs! Reason: %sz*Failed to prcess TSPKG package! Reason: %sr   $T)bytes_expected)#r1   	Exceptionlogr$   mover   readr   errorwalk_avlBalancedRoot
RightChildlog_ptrr"   credential_structr   
pTsPrimaryr   LocallyUniqueIdentifierr   r#   UserNameread_stringr   Domainer
   PasswordLengthread_maxdataendswithdecrypt_passwordr   r   r   append)r   entry_ptr_valueentry_ptr_loceresult_ptr_list
start_nodeptrr=   primary_credentialcenc_datar   r   r   start8   sL   
zTspkgDecryptor.start)r   r   r   r   r1   rR   __classcell__r   r   r'   r   r   +   s    r   )
ior   pypykatzr   %pypykatz.lsadecryptor.package_commonsr   pypykatz.commons.win_datatypesr   r   r   r   r   r   r   <module>   s   